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DETAILED ACTION 



1. 



Claims 1-4, 6, 8-20, 23, 25, and 26 are pending. 



2. 



Amendment filed 01/04/2008 has been received and 



considered. 



Information Disclosure Statement 



3. The IDS filed 10/31/2007 has been received. Due to the 
vast number of references cited on the IDS only a cursory 
consideration of these documents has been conducted. 



4. The following is a quotation of the appropriate paragraphs 
of 35 U.S.C. 102 that form the basis for the rejections under 
this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published 
under section 122 (b) , by another filed in the United States before the 
invention by the applicant for patent or (2) a patent granted on an 
application for patent by another filed in the United States before the 
invention by the applicant for patent, except that an international 
application filed under the treaty defined in section 351 (a) shall have the 
effects for purposes of this subsection of an application filed in the 
United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English 



5. Claims 9-19, 23, and 24 are rejected under 35 U.S.C. 102(e) 
as being anticipated by Squier et al . (US 7188181). 

As per claims 1, 9-13, 17, and 23, Squier et al . discloses 



Claim Rejections - 35 USC §102 



language . 



inputting at a first system that grants session credentials 
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based on successful authentication, a request from a client to 
access a protected resource on the first system, the protected 
resource on the first system being accessible by the client only 
after successful authentication of the client at the first 
system (see column 5 lines 54-63) ; determining at the first 
system that a client does not have a valid session credential 
granted by the first system (see column 5 line 64 through column 
6 line 4) ; retrieving, at the first system, information from a 
session token held by the client, the information being 
retrieved from the client, the information corresponding to a 
session credential for the second system, the second system 
grants session credentials based on successful authentication at 
the second system and includes protected resources on the second 
system that is accessible by the client, the protected resource 
on the second system being accessible by the client only after 
successful authentication of the client at the second system 
(see column 6 lines 4-15) the first system presenting at least 
some of the information from the session token to the second 
system; the first system inputting a determination from the 
second system that the client has a valid session credential 
with the second system; and the first system effecting 
successful authentication to the client so as to grant access to 
the protected resource on the first system, to the client based 
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on the determination from the second system that the client has 
a valid session credential with the second system (see column 6 
line 41 through column 7 line 5 see also figure 2) the first 
system inputting information from the second system and in 
response the first system outputting to the second system a 
determination that the first system has a valid session 
credential for the client at the first system; and the second 
system effecting successful authentication so as to grant access 
to the further protected resource on the second system to the 
client based on the determination from the first system that the 
client has a valid session credential with the first system (see 
column 6 lines 41-56 and column 8 lines 29-63 and column 9 lines 
2-4) . 

As per claim 14, Squier et al . discloses granting a session 
credential to the client by the first system, after determining 
that the client has a valid session credential granted by the 
second system (see column 6 lines 57-62) . 

As per claim 15, Squier et al . discloses maintaining the 
client session credential granted by the second system (see 
column 6 lies 57-64) . 

As per claims 16 and 19, Squier et al . discloses 
associating session credentials for the first system and the 
second system with the client (see column 6 lines 57-64) . 
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As per claim 18 Squier et al . discloses granting the client 
session credentials for the first system (see column 6 lines 57- 
64) . 

Claim Rejections - 35 USC §103 

6. The following is a quotation of 35 U.S.C. 103(a) which 
forms the basis for all obviousness rejections set forth in this 
Office action: 

(a) A patent may not be obtained though the invention is not identically 
disclosed or described as set forth in section 102 of this title, if the 
differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at 
the time the invention was made to a person having ordinary skill in the 
art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

7. Claims 1-4, 6, 8 and 20 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over Squier et al . in view of Howard et 
al. (US 6584505) . 

As per claims 1 and 20, Squier et al . discloses inputting 
at a first system that grants session credentials based on 
successful authentication, a request from a client to access a 
protected resource on the first system, the protected resource 
on the first system being accessible by the client only after 
successful authentication of the client at the first system (see 
column 5 lines 54-63) ; determining at the first system that a 
client does not have a valid session credential granted by the 
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first system (see column 5 line 64 through column 6 line 4) ; 
retrieving, at the first system, information from a session 
token held by the client, the information being retrieved from 
the client, the information corresponding to a session 
credential for the second system, the second system grants 
session credentials based on successful authentication at the 
second system and includes protected resources on the second 
system that is accessible by the client, the protected resource 
on the second system being accessible by the client only after 
successful authentication of the client at the second system 
(see column 6 lines 4-15) the first system presenting at least 
some of the information from the session token to the second 
system; the first system inputting a determination from the 
second system that the client has a valid session credential 
with the second system; and the first system effecting 
successful authentication to the client so as to grant access to 
the protected resource on the first system, to the client based 
on the determination from the second system that the client has 
a valid session credential with the second system (see column 6 
line 41 through column 7 line 5 see also figure 2) . 

Sguier et al . fails to discloses directing the client to 
the first system to establish a session credential based on 
successful authentication at the first system, after determining 
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that the client does not have a valid session credential granted 
by the second system. 

However, Howard et al . teaches such redirection (see column 
6 lines 51-52 and column 8 lines 54-57) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to redirect the client to 
a different server upon failed authentication. 

Motivation to do so would have been to allow the user to 
authenticate to a known server (see Howard et al . column 7 lines 
52-65) . 

As per claim 2, the modified Squier et al . and Howard et 
al. system discloses granting a session credential to the client 
by the first system, after determining that the client has a 
valid session credential granted by the second system (see 
Squier et al . column 6 lines 57-62). 

As per claim 3, the modified Squier et al . and Howard et 
al. system discloses sending a session token to the client, the 
token corresponding to a session credential granted by the first 
system (see Squier et al . column 6 lines 57-62). 

As per claim 4, the modified Squier et al . and Howard et 
al. system discloses a method comprising directing the client to 
the second system to establish a session credential based on 
successful authentication at the second system, after 
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determining that the client does not have a valid session 
credential granted by the second system (see Squier et al . 
column 6 lines 30-40) . 

As per claim 6, the modified Squier et al . and Howard et 
al. system discloses maintaining the client session credential 
granted by the second system (see Squier et al . column 6 lies 
57-64) . 

As per claim 8, the modified Squier et al . and Howard et 
al. system discloses retrieving information from the session 
token held by the client comprises: sending a query to the 
client from the first system, the query including identification 
as originating from a domain name corresponding to the second 
system; and receiving a response to the query (see Howard column 
8, lines 8-11) . 

8. Claims 25 and 26 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Squier et al . as applied to claim 23 
above, and further in view of Marks et al . (US 20010054059). 

As per claims 25 and 26 Squier et al . fails to disclose 
that the protected resource is pay-per-use or subscription 
content . 

However, Marks et al . teaches content of this type (see 
paragraph [0028] ) . 
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At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to protect pay-per-use and 
subscription content using the Squier et al . system. 

Motivation to do so would have been that this type of 
content costs money and protecting them prevents free use of the 
content . 

Response to Arguments 

9. Applicant's arguments filed 01/04/2008 have been fully 
considered but they are not persuasive. Applicant argues that 
Squier fails to teach the limitations added to, for example, 
claim 23 and Howard fails to teach the limitations of claim 5 
(now incorporated into claim 1) . 

With respect to Applicant's argument that Squier fails to 
disclose the first system inputting information from the second 
system and in response the first system outputting to the second 
system a determination that the first system has a valid session 
credential for the client at the first system; and the second 
system effecting successful authentication so as to grant access 
to the further protected resource on the second system to the 
client based on the determination from the first system that the 
client has a valid session credential with the first system, in 
step 216 of Figure 2B the origin server determines whether it 
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can authenticate a session identifier provided by the 
destination server. This process is further described with 
respect to Figure 5 where the destination sends the session 
identifier to the origin server and the origin server determines 
if it is valid and sends the appropriate data whether it is 
valid (i.e. authenticated). If the session identifier is 
authenticated by the origin server the destination server issues 
a session identifier for the client to use on the destination 
server. Therefore, Squier discloses the each and every 
limitation of claim 23. 

With respect to Applicant's argument that Howard fails to 
disclose the directing step of claim 1, Examiner would first 
like to note that the first recitation of the "second system" as 
noted by Applicant (see page 18 of the response) was merely a 
typographical error and has been corrected above. Furthermore, 
Howard teaches directing the client to the first system to 
establish a session credential based on successful 
authentication at the first system, after determining that the 
client does not have a valid session credential granted by the 
second system in Figures 4 and 5 and the corresponding 
description in the specification. Specifically, Howard teaches 
the affiliate server (i.e. second system) determining that the 
user is not authenticated and redirecting the user to the 
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authentication server (i.e. the first system) (see numeral 202). 
Therefore, Howard teaches directing the client to the first 
system to establish a session credential based on successful 
authentication at the first system, after determining that the 
client does not have a valid session credential granted by the 
second system and the combination is proper. 

Applicant's argument that Marks fails to cure the 
deficiencies of Squier is moot in view of the above response. 

Conclusion 

10. THIS ACTION IS MADE FINAL. Applicant is reminded of the 
extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action 
is set to expire THREE MONTHS from the mailing date of this 
action. In the event a first reply is filed within TWO MONTHS 
of the mailing date of this final action and the advisory action 
is not mailed until after the end of the THREE-MONTH shortened 
statutory period, then the shortened statutory period will 
expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated 
from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than 
SIX MONTHS from the mailing date of this final action. 
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Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to MICHAEL 
PYZOCHA whose telephone number is (571)272-3875. The examiner 
can normally be reached on 7:00am - 4:30pm first Fridays of the 
bi-week off. 

If attempts to reach the examiner by telephone are 
unsuccessful, the examiner's supervisor, Emmanuel Moise can be 
reached on (571) 272-3865. The fax phone number for the 
organization where this application or proceeding is assigned is 
571-273-8300. 

Information regarding the status of an application may be 
obtained from the Patent Application Information Retrieval 

(PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free) . If you would 
like assistance from a USPTO Customer Service Representative or 
access to the automated information system, call 800-786-9199 

(IN USA OR CANADA) or 571-272-1000. 
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MJP 

/Emmanuel L. Moise/ 

Supervisory Patent Examiner, Art Unit 2137 



